Privacy Policy

Transformation, Co. (formerly Altrix Technologies, Inc.), a Delaware corporation operating as Latent Variables (“Latent Variables,” “Company,” “we,” “us,” or “our”), respects your privacy and is committed to protecting personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with our workplace survey services, including survey communications delivered by text message (SMS) and by automated voice call, and our website at www.latentvariables.com (the “Site”). By participating in our programs or using the Site, you acknowledge the practices described in this Policy.

This Policy applies to personal information processed by Latent Variables when we act as a service provider to employers that engage us (“Client Organizations”) to administer workplace surveys to their personnel, and when we operate the Site. Where we process personal information on behalf of a Client Organization, we do so under that organization’s instructions and applicable agreements, and the Client Organization’s own privacy notices may also apply to its personnel.

3.1 Information you or your employer provide

• Identifiers and contact information, including mobile telephone number, name where provided, and employer affiliation.
• Consent records, including confirmation of consent and the date and method by which it was obtained.
• Survey responses and related feedback that you choose to provide.

3.2 Voice information

• Where surveys are conducted by telephone, call audio, and, where recorded, call recordings and written transcripts of those recordings.

3.3 Information generated by our services

• Inferences, summaries, scores, and analytics derived from survey responses and transcripts through automated and artificial-intelligence processing.
• Message and call metadata, including timestamps, delivery and disposition status, and opt-out status.

3.4 Information collected on the Site

• Device and usage information such as IP address, browser type, pages viewed, and similar technical data collected through cookies and comparable technologies, as described in Section 9.
• Contact details you choose to submit on the Site, such as an email address entered in the newsletter form, which we store in our analytics system solely to deliver what you signed up for.

Some of the information above may constitute “sensitive personal information” under applicable law, for example the contents of voice recordings. We process such information only as necessary to provide our services and as permitted by law.

We collect personal information (a) directly from you when you provide your mobile number, give consent, respond to a survey, or contact us; (b) from your employer or Client Organization in connection with the services it has engaged us to perform; and (c) automatically through the Site and our messaging and calling infrastructure.

We use personal information to: administer and deliver the workplace survey program engaged by a Client Organization; send survey invitations, reminders, and related support communications by SMS and voice; conduct and process voice surveys; generate aggregated workplace feedback, analytics, and insights for the Client Organization; provide customer and technical support; maintain consent and opt-out records; secure, monitor, and improve our services; and comply with legal obligations. Survey participation is voluntary.

Our services use artificial-intelligence and machine-learning technologies. Voice surveys may be conducted using an automated or artificial voice, and survey responses and call transcripts may be analyzed by automated systems to generate themes, sentiment, summaries, and aggregate insights for Client Organizations.

We do not use automated processing to make decisions that produce legal effects concerning an individual or that similarly significantly affect an individual, such as decisions regarding hiring, termination, compensation, or discipline. Insights we provide to Client Organizations are intended to inform human review and are generally delivered in aggregated or de-identified form. We do not use survey content to engage in unlawful discrimination, and we maintain human oversight of our automated systems. Where applicable law requires notice of automated processing or automated employment decision tools, we provide such notice and honor applicable rights. If our use of automated processing changes materially, we will update this Policy and provide any additional disclosures required by law.

Where surveys are conducted by telephone, calls may be placed using an automated or artificial voice. At the outset of each call, we identify Latent Variables and the Client Organization on whose behalf the call is made. A written transcript of the conversation is always kept. Audio is recorded only if you agree when asked at the start of the call; declining audio does not end the interview, which simply continues with the transcript alone. We handle recordings consistent with applicable call-recording and wiretapping laws, including the laws of jurisdictions that require the consent of all parties to a recording.

The Site uses a consent banner. Non-essential cookies, meaning analytics and advertising cookies, are not set until you accept, and rejecting them is as easy as accepting and is remembered the same way. Site and product analytics are provided by PostHog, our analytics provider listed in Section 10. Our Cookie Policy lists every cookie the Site and our application actually set, its purpose, and its duration, and includes a control for changing your choice. You can also control cookies through your browser settings.

• Client Organizations. We disclose survey results to the employer that engaged us, generally in aggregated or de-identified form where feasible.
• Service providers (sub-processors). We disclose personal information to vendors that perform services on our behalf, under contracts that restrict their use of the information to providing services to us. Our sub-processors, the purpose for which each processes personal information, and the categories of personal information involved are listed in the table below.
• Legal and protective disclosures. We may disclose information to comply with law, respond to lawful requests, enforce our agreements, or protect the rights, safety, and property of Latent Variables, our users, or others.
• Business transfers. We may disclose information in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

Each sub-processor processes personal information in the United States. Where personal information originates outside the United States, transfers rely on the European Commission’s Standard Contractual Clauses (SCCs). We will update this list as our sub-processors change.

Authentication providers

Sign-in providers are disclosed separately from the sub-processor table because they are independent controllers, not sub-processors: personal information does not flow to them on our behalf beyond the authentication handshake, and they process the account data involved for their own purposes under their own privacy policies.

When you choose Sign-in with Google, Google LLC acts as an independent controller of your Google account data — Names and email addresses (Google account profile shared at sign-in); Authentication identifiers (OAuth tokens and account IDs) — which it processes under its own privacy policy.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We retain personal information for as long as necessary to provide the services, operate our programs, and satisfy legal, contractual, tax, and recordkeeping obligations, including the retention of consent and opt-out records. When information is no longer required for these purposes, we delete or de-identify it.

For interview data specifically: transcripts and the findings derived from them are retained for 12 months. Audio recordings, where a respondent has agreed to audio, are retained for 365 days in retention-locked storage; each recording is encrypted with its own key, and an honored erasure request destroys that key so the recording is cryptographically unreadable even while the storage lock remains in force.

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

This section applies to people located in the European Union or the United Kingdom who take part in a Latent Variables interview. A shorter plain-language version is linked from every interview page before the interview begins.

13.1 Controller and processor

The Client Organization that commissioned the engagement (typically your employer) is the data controller. Transformation, Co., doing business as Latent Variables, is the data processor: we conduct the interview and process responses on the controller's behalf, under a data processing agreement and its documented instructions.

13.2 Lawful basis

The lawful basis for processing is the controller's legitimate interest in understanding how work happens in its organization, under Article 6(1)(f) GDPR. The basis is not consent. Participation is nonetheless voluntary, and a respondent may stop an interview at any time.

13.3 What is collected

A written transcript of the conversation is always kept. An audio recording is kept only if the respondent agrees when asked during the call; declining, or giving an unclear answer, means no audio is kept and the interview continues from the transcript alone.

13.4 Safeguards

• Aggregate findings ride a minimum-voices floor: no finding is exposed unless at least three distinct people (k of 3 or more) contributed to it. The floor is enforced in code and cannot be overridden by configuration.
• Names, dates, and places are deterministically redacted at every point where interview material leaves the system.
• Statements are never attributed to identifiable individuals.
• Analysis of tone and other paralinguistic signals is disabled for EU and UK respondents through a fail-closed control in code.

13.5 What the controller receives

Anonymized, aggregated findings, occasionally including brief quotes with names, dates, and places redacted, are shared with the Client Organization's leadership. Because interviews describe how the organization works, findings may concern people who are mentioned in responses, such as colleagues or managers, in the same anonymized and aggregated form.

13.6 Retention

Transcripts and derived findings are retained for 12 months. Audio is retained for up to 365 days in retention-locked storage — a ceiling, not a floor — and is deleted earlier to honor erasure as described in Section 11.

13.7 Your rights

Respondents have the rights of access, rectification, and erasure (requests are honored within one month, as the GDPR requires), and the right to object to the processing. Requests can be made through the Client Organization as controller, directly to us at privacy@latentvariables.com, or through our EU and UK representative's request pages listed in Section 13.9, and we will assist the controller in responding.

13.8 International transfers

Processing occurs in the United States. Transfers of EU and UK personal data are governed by the EU Standard Contractual Clauses incorporated into our agreements with the controller.

13.9 EU and UK representatives (Article 27)

We have appointed representatives in the EU and the UK under Article 27 GDPR and Article 27 UK GDPR. EU and UK data subjects and supervisory authorities may contact us through them:

• EU: Instant EU GDPR Representative Ltd, Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland — latentvariables.gdprlocal.com/eu
• UK:GDPRLocal Ltd., 1st Floor Front Suite, 27–29 North Street, Brighton, England BN1 1EB — latentvariables.gdprlocal.com/uk

13.10 Privacy contact

We have not appointed a Data Protection Officer; the Article 37(1) thresholds are not met. The privacy contact is our Privacy Officer, reachable at privacy@latentvariables.com or as set out in Section 19.

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”). Subject to verification and legal exceptions, California residents have the right to:

• Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Request deletion of personal information we have collected, subject to exceptions.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information.
• Limit the use and disclosure of sensitive personal information to permitted purposes.
• Be free from unlawful discrimination for exercising these rights.

To exercise these rights, contact us using the details in Section 19. You may use an authorized agent to submit a request, subject to verification. We will respond within the timeframes required by law. Where we process personal information on behalf of a Client Organization as a service provider, we will refer your request to that organization or assist it in responding, as appropriate.

Residents of other states that have enacted comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, and others, may have rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of certain processing. We honor applicable rights and will respond to verified requests submitted as described in Section 19.

Our services are directed to personnel of the organizations we serve and are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected such information, we will delete it.

Our services are operated in the United States. If you access our services from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those of your jurisdiction. Where an engagement includes interview respondents in the European Union or the United Kingdom, the transfer safeguards and protections described in Section 13 apply, including the EU Standard Contractual Clauses.

We may update this Policy from time to time. We will post the revised Policy at this location and update the effective date above. Material changes will be communicated as required by law.